Cyber attacks and other malicious activity reached unprecedented levels in 2021, impacting all kinds of U.S.-based small businesses. Over the course of the year, the FBI’s Internet Crime Complaint Center (IC3) received almost 850,000 complaints. It also recorded over $6.9 billion in potential losses due to cyber incidents. 

As cyber threats continue to spread, organizations should take every precaution available to lower their overall cyber risk. Cyber insurance can provide an effective stopgap for cyber risk. Comprehensive cyber insurance covers everything from indemnification for legal fees to incident recovery costs. 

However, to qualify for such coverage, an organization must meet certain security requirements. These requirements also align with overall cybersecurity best practices and controls to protect a business.

Insurance companies typically look for five essential cyber insurance requirements before agreeing to provide cyber insurance coverage. Chances are that your clients lack these security controls across their computer systems and IT infrastructure. In that case, the following security controls can reduce the likelihood and impact of a cyber incident while helping to qualify the business for coverage.

1. Multi-factor authentication

Multi-factor authentication (MFA), also known as two-factor authentication, is one of the best security controls available for securing user accounts and preventing unauthorized logins. MFA requires users to log into an account to validate their identity with a username and password. An additional layer of security authenticates users by way of a second factor," such as a one-time code sent to their mobile device, email, or from a token.

Internally, when required for every login, MFA adds an additional layer of protection, making it more difficult for threat actors to access unauthorized resources. It’s also a necessity in an increasingly remote workforce, when users can log into almost any work device from almost anywhere.

Externally, MFA can reduce the number of internet-facing accounts threat actors may attempt to break into, such as work email accounts. It can also limit the impact of cyber attacks like social engineering. Even if a threat actor obtains a password, they would still need the additional level of authentication to access the account.

2. Cybersecurity training 

Cybersecurity training is one the most cost-effective security methods available. Routine training can help educate team members about the latest threats and remind them to stay vigilant against potential malicious activity. It also matters because the majority of breaches come from human error.

According to Verizon’s 2022 Data Breach Investigations Report, 82% of breaches this year were initially caused by human error. This includes the use of stolen credentials after someone fell for a phishing email and social engineering attempts. Cybersecurity training can teach employees to avoid these mistakes, potentially minimizing data breaches.  

3. Maintain good data backups

A good data backup can mean the difference between a complete loss or a full recovery after a cyber attack. Maintaining data backups may also be a recommendation for your cyber insurance policy, depending on your organization’s data. 

Redundancy is critical in a good backup strategy. Businesses should use both on- and off-site backups for storing essential data. It's critical that at least one form of backup be stored completely separate from the primary network, such as in an external drive or tape. Store one copy on an off-site device, like a cloud server.  

Test your backups by frequently conducting a full recovery. All too often, organizations only test their backups when they need them, and find out that their restoration has failed or backups were inadequate. In the case of increasingly common ransomware attacks, backups are the key determinant of whether a ransom payment is made or not. Without backups, a business is at the mercy of threat actors. 

4. Identity access management

While there are numerous ways of applying identity access management (IAM) across networks, the basic focus is on assigning and managing digital identities for users that require it. This helps ensure that only certain users can access certain data, depending on their role within the organization. 

5. Enforcing data classification

This means that users should only have enough digital rights to perform their job functions. Data classification or “need to know” access helps organizations to ensure they are enforcing this principle across all devices to meet cyber insurance requirements. 

In a strict application of least privilege, users would not have the right to install or modify software on a company-issued device. They would only be able to access data and resources pertinent to their role. 

In addition to the essential cyber insurance requirements, there are some other components that are less critical but still important. Following these requirements can help an organization secure more favorable rates on a cyber policy and ensure that its security controls are effective. 

• Strong password policies. Passwords are at the forefront of security controls. Businesses should ensure that all employee and network passwords are unique, strong, and regularly changed. 

• Antivirus or Endpoint Detection and Response (EDR) software. Your clients should install and regularly update antivirus or EDR software on all user devices. This can increase the chances of identifying a potential vulnerability before it turns into a claim. 

• Firewalls. Through firewalls, your clients can block incoming and outgoing traffic on devices according to rules that the system administrator sets. A firewall can block incoming malicious traffic and outgoing threat actor communications from a compromised device. 

• Incident response plans. All organizations should have a cyber incident response plan in place in case of a cyber incident. These plans lay out a series of concrete steps and stakeholders the business should initiate to prepare for, and respond to, an incident. 

• Security risk assessments. These assessments can help your clients identify any vulnerabilities within their networks and processes. They give businesses clearer insights into the concrete steps they can take to improve their overall cybersecurity. 

Cyber insurance requirements largely resemble the general best practices that organizations should follow to minimize and mitigate their cyber risk. However, implementing these requirements can be challenging for small business owners. Coalition can streamline the entire process of protecting a business and qualifying for cyber insurance.